Skip to main content
Glama

mark_confirmed

Confirm a stored security finding with a required reason only when a reproduced verification result exists; otherwise refuse the request, because an LLM verdict alone cannot set confirmation.

Instructions

Mark a stored finding confirmed. reason is required.

Only when a verification result with status reproduced exists for the finding. Otherwise the call is refused, and an LLM verdict alone cannot set confirmation.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "finding_id": "<finding_id>",
      "reason": "<reason>"
    },
    "name": "mark_confirmed"
  }
}

Input Schema

NameRequiredDescriptionDefault
reasonYes
db_pathNo
finding_idYes

Output Schema

NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv0.5.11

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations supplied, the description carries the full behavioral burden and does real work: it discloses that the call is refused when the precondition is unmet and that confirmation cannot be asserted from an LLM verdict alone. It does not cover idempotency, whether confirmation is reversible, or permission requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The precondition is front-loaded and the total length is two short sentences with no filler. The awkward line breaks add no information but do not obscure the content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the critical gating logic is documented. However, for a mutation tool with zero annotation coverage and three undocumented-by-schema parameters, the unexplained db_path and the silent finding_id leave gaps an agent could stumble on.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must explain all three parameters, but it only reinforces that reason is required (already encoded in the schema's required list). finding_id is left to inference and db_path is never mentioned at all, leaving a materially undocumented parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ("Mark a stored finding confirmed") and qualifies it with a hard precondition, which separates it from generic mutations like update_finding. It does not explicitly contrast itself with mark_fp or verify_finding, so the differentiation is implied by the word "confirmed" rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Only when a verification result with status reproduced exists for the finding" is an explicit, checkable gating condition, and the description adds a strong negative rule: an LLM verdict alone cannot set confirmation. It stops short of naming a prerequisite tool (e.g., that you should call verify_finding first) or saying what to do instead when the gate fails.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.